密码哈希和密钥派生：将秘密变成安全的乱码，Go Crypto 8-Golang-PHP中文网

首页

后端开发

Golang

密码哈希和密钥派生：将秘密变成安全的乱码，Go Crypto 8

Susan Sarandon

Nov 19, 2024 am 10:01 AM

Password Hashing and Key Derivation: Turning Secrets into Secure Gibberish, Go Crypto 8

嘿，加密货币冠军！准备好深入密码散列和密钥派生的世界了吗？将这些视为将密码和密钥变成安全、不可读的乱码的秘诀。让我们看看 Go 如何帮助我们创造一些加密魔法！

密码哈希：使密码不可读（甚至对我们来说也是如此！）

首先，我们来谈谈密码哈希。这就像将密码放入加密混合器中 - 结果看起来与输入的完全不同，而这正是我们想要的！

Bcrypt：经典密码冰沙

Bcrypt 就像密码哈希的经典冰沙 - 经过尝试、测试，仍然美味。使用方法如下：

import (
    "fmt"
    "golang.org/x/crypto/bcrypt"
)

func main() {
    password := []byte("iLoveCrypto123")

    // Let's blend this password!
    hashedPassword, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
    if err != nil {
        panic("Our cryptographic blender broke!")
    }

    fmt.Printf("Our password smoothie: %x\n", hashedPassword)

    // Now, let's see if we can recognize our original password
    err = bcrypt.CompareHashAndPassword(hashedPassword, password)
    if err != nil {
        fmt.Println("Nope, that's not our password!")
    } else {
        fmt.Println("Yep, that's our password alright!")
    }
}

Argon2：更新、更精美的冰沙

Argon2 就像包含所有超级食物的新型冰沙 - 它的设计对现代密码破解技术具有额外的抵抗力。使用方法如下：

import (
    "crypto/rand"
    "encoding/base64"
    "fmt"
    "golang.org/x/crypto/argon2"
)

func main() {
    password := []byte("iLoveCryptoEvenMore456")

    // First, let's add some salt to our smoothie
    salt := make([]byte, 16)
    if _, err := rand.Read(salt); err != nil {
        panic("Our salt shaker is empty!")
    }

    // Now, let's blend our password
    timeCost := uint32(1)
    memoryCost := uint32(64 * 1024)
    threads := uint8(4)
    keyLength := uint32(32)

    hash := argon2.IDKey(password, salt, timeCost, memoryCost, threads, keyLength)

    // Let's encode our smoothie and salt for storage
    encodedHash := base64.RawStdEncoding.EncodeToString(hash)
    encodedSalt := base64.RawStdEncoding.EncodeToString(salt)

    fmt.Printf("Our fancy password smoothie: %s\n", encodedHash)
    fmt.Printf("Our salt: %s\n", encodedSalt)

    // To verify, we'd need to decode the salt, reblend with the same recipe, and compare
}

密钥派生：将密码转换为加密密钥

现在，我们来谈谈密钥派生。这就像将简单的密码变成可以解锁我们的加密宝藏的复杂密钥。

PBKDF2：经典钥匙制作器

PBKDF2 就像一台古老、可靠的钥匙切割机。它会获取您的密码并将其变成闪亮的新密钥。方法如下：

import (
    "crypto/rand"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "golang.org/x/crypto/pbkdf2"
)

func main() {
    password := []byte("OpenSesame123")

    // Let's add some randomness to our key-making process
    salt := make([]byte, 16)
    if _, err := rand.Read(salt); err != nil {
        panic("Our randomness generator broke!")
    }

    // Time to make our key
    iterations := 100000
    keyLength := 32
    key := pbkdf2.Key(password, salt, iterations, keyLength, sha256.New)

    // Let's encode our new key and salt
    encodedKey := base64.RawStdEncoding.EncodeToString(key)
    encodedSalt := base64.RawStdEncoding.EncodeToString(salt)

    fmt.Printf("Our shiny new key: %s\n", encodedKey)
    fmt.Printf("The salt we used: %s\n", encodedSalt)
}

HKDF：关键工厂

HKDF 就像一个神奇的钥匙工厂，可以从一个秘密中生产出多个钥匙。当您需要多把钥匙用于不同目的时，它是完美的选择。使用方法如下：

import (
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "golang.org/x/crypto/hkdf"
    "io"
)

func main() {
    secret := []byte("MySuper
SecretValue")
    salt := []byte("SaltySalt")
    info := []byte("KeyForEncryption")

    // Let's start up our key factory
    keyFactory := hkdf.New(sha256.New, secret, salt, info)

    // Now, let's produce two 32-byte keys
    key1 := make([]byte, 32)
    key2 := make([]byte, 32)

    if _, err := io.ReadFull(keyFactory, key1); err != nil {
        panic("Our key factory had a malfunction!")
    }
    if _, err := io.ReadFull(keyFactory, key2); err != nil {
        panic("Our key factory is tired and can't make another key!")
    }

    // Let's encode our new keys
    encodedKey1 := base64.RawStdEncoding.EncodeToString(key1)
    encodedKey2 := base64.RawStdEncoding.EncodeToString(key2)

    fmt.Printf("Our first key: %s\n", encodedKey1)
    fmt.Printf("Our second key: %s\n", encodedKey2)
}